Malware analysis x86_64 Malicious activity | ANY.RUN

Add for printing

File name:	x86_64
Full analysis:	https://app.any.run/tasks/29c023b9-ba61-4d7d-a88d-f4b5eee13104
Verdict:	Malicious activity
Threats:	A botnet is a group of internet-connected devices that are controlled by a single individual or group, often without the knowledge or consent of the device owners. These devices can be used to launch a variety of malicious attacks, such as distributed denial-of-service (DDoS) attacks, spam campaigns, and data theft. Botnet malware is the software that is used to infect devices and turn them into part of a botnet. Mirai is a self-propagating malware that scans the internet for vulnerable IoT devices and infects them to create a botnet. Mirai variants utilize lists of common default credentials to gain access to devices. Mirai's primary use is for launching distributed denial-of-service (DDoS) attacks, but it has also been used for cryptocurrency mining. Malware Trends Tracker >>>
Analysis date:	August 21, 2024, 18:47:36
OS:	Ubuntu 22.04.2
Tags:	mirai botnet moobot
Indicators:
MIME:	application/x-executable
File info:	ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, stripped
MD5:	9B0DAF70BC6EE71FF95EB36F10D0C337
SHA1:	E500DFB8CA56B084226D9B49F99553000BD0EDA8
SHA256:	E38146B8AF6197F91E45D7745F8DA0B86EB998CF17101FB0504521B26F6B02DC
SSDEEP:	768:nF98/zcVt4Lx84LpswKYSEWseUV25/oO/sxR01TbYc8kBRiOgPFNJ0tdTJFI:nz8/zcVt4LxhpsRYndd2SElLBRkXq

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Add for printing

MALICIOUS
- Connects to the CnC server
  - x86_64.o (PID: 12939)
- MIRAI has been detected (SURICATA)
  - x86_64.o (PID: 12939)
SUSPICIOUS
- Reads /proc/mounts (likely used to find writable filesystems)
  - fusermount3 (PID: 12941)
  - gjs (PID: 13332)
  - snapd-desktop-integration (PID: 13389)
- Intercepts program crashes
  - apport (PID: 12942)
- Modifies file or directory owner
  - sudo (PID: 12932)
- Contacting a server suspected of hosting an CnC
  - x86_64.o (PID: 12939)
- Executes commands using command-line interpreter
  - Xwayland (PID: 13121)
- Executes the "rm" command to delete files or directories
  - snapd-desktop-integration (PID: 13389)
- Connects to unusual port
  - x86_64.o (PID: 12939)
INFO
No info indicators.

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

TRiD

.o	\|	ELF Executable and Linkable format (generic) (100)

EXIF

EXE

CPUArchitecture:	64 bit
CPUByteOrder:	Little endian
ObjectFileType:	Executable file
CPUType:	AMD x86-64

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

353

Monitored processes

133

Malicious processes

2

Suspicious processes

1

Behavior graph

Click at the process to see the details

Process information

PID	CMD	Path	Indicators	Parent process
12931	/bin/sh -c "sudo chown user /tmp/x86_64\.o && chmod +x /tmp/x86_64\.o && DISPLAY=:0 sudo -iu user /tmp/x86_64\.o "	/bin/sh	—	any-guest-agent
User: root Integrity Level: UNKNOWN Exit code: 0
12932	sudo chown user /tmp/x86_64.o	/usr/bin/sudo	—	sh
User: root Integrity Level: UNKNOWN Exit code: 0
12933	chown user /tmp/x86_64.o	/usr/bin/chown	—	sudo
User: root Integrity Level: UNKNOWN Exit code: 0
12934	chmod +x /tmp/x86_64.o	/usr/bin/chmod	—	sh
User: root Integrity Level: UNKNOWN Exit code: 0
12935	sudo -iu user /tmp/x86_64.o	/usr/bin/sudo	—	sh
User: root Integrity Level: UNKNOWN Exit code: 0
12936	/tmp/x86_64.o	/tmp/x86_64.o	—	sudo
User: user Integrity Level: UNKNOWN Exit code: 0
12937	/usr/bin/locale-check C.UTF-8	/usr/bin/locale-check	—	x86_64.o
User: user Integrity Level: UNKNOWN Exit code: 0
12938	/tmp/x86_64.o	/tmp/x86_64.o	—	x86_64.o
User: user Integrity Level: UNKNOWN
12939	(sd-pam) 64.o	/tmp/x86_64.o		x86_64.o
User: user Integrity Level: UNKNOWN
12941	fusermount3 -o rw,nosuid,nodev,fsname=portal,auto_unmount,subtype=portal -- /run/user/1000/doc	/usr/bin/fusermount3	—	fusermount3
User: user Integrity Level: UNKNOWN Exit code: 0

Add for printing

Executable files

0

Suspicious files

11

Text files

8

Unknown types

0

Dropped files

PID	Process	Filename		Type
13178	ibus-daemon	/var/lib/gdm3/.config/ibus/bus/b82edf789d4944789b773e6aeadf24e8-unix-1024 (deleted)		text
		MD5:DFF449D13239C0A3D44856882BA194C7	SHA256:8CF5DBCEEE0E92936DE3F58859B47463F70F6D500A4A6F839586F158AB9A88BE
13123	whoopsie	/var/lib/whoopsie/whoopsie-id (deleted)		text
		MD5:E703EEEE37B13C3F2BA103A45507287A	SHA256:FB5D398C4DE8E23E16ADBCE21ADBA7ED48563334ABDFD472CE7AF0B061B48E7C
12942	apport	/var/log/apport.log		text
		MD5:342FABA2F61CD5754431643E50DCCCBE	SHA256:081EC32DE909D2AC1297CA404BA9244418DE88CFF40F6549FE8AC3FF70C9A575
13472	gvfsd-metadata	/var/lib/gdm3/.local/share/gvfs-metadata/root		binary
		MD5:0743F105309AA646B43ECF796DC27CA3	SHA256:901AD658325B78BEACC64D215D0B57F103B8ED7779F8A758EDB799306F2204F8
13339	ibus-daemon	/var/lib/gdm3/.config/ibus/bus/b82edf789d4944789b773e6aeadf24e8-unix-wayland-0		text
		MD5:23722E6822B267A9FB43FB9239AA9441	SHA256:751741B7342D3252B146DFD0314B440B1D34C2FA4C441EFBF90FB0812E6E9B31
13177	gnome-session-binary	/var/lib/gdm3/.local/share/icc/edid-d566d177510e5f6427207727888b1a0b.icc		binary
		MD5:2C6496A2A9166020ABC007AED12842A8	SHA256:09576ACBAE4D98DEC7602B60108C67EE4A2BC59CEB09C10A60798242A2500BA2
13178	ibus-daemon	/var/lib/gdm3/.config/ibus/bus/b82edf789d4944789b773e6aeadf24e8-unix-wayland-0 (deleted)		text
		MD5:DFF449D13239C0A3D44856882BA194C7	SHA256:8CF5DBCEEE0E92936DE3F58859B47463F70F6D500A4A6F839586F158AB9A88BE
13178	ibus-daemon	/var/lib/gdm3/.cache/ibus/bus/registry		binary
		MD5:CE7083E92ED00B1959FF72E00711E4A2	SHA256:623BB8AF942F2A779A020D301F2AEDFBAF4725A6708344A1B0F556A34C6A7BC9
13072	dconf-service	/home/user/.config/dconf/user		bs
		MD5:0F8F5F34459960ED99B0E76C6B9DE783	SHA256:791CEE653E0E3D5A7A467775642074685531DFBAFF4405315C360F6220CB8104
13339	ibus-daemon	/var/lib/gdm3/.config/ibus/bus/b82edf789d4944789b773e6aeadf24e8-unix-1024		text
		MD5:23722E6822B267A9FB43FB9239AA9441	SHA256:751741B7342D3252B146DFD0314B440B1D34C2FA4C441EFBF90FB0812E6E9B31

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

1

TCP/UDP connections

19

DNS requests

24

Threats

1

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
—	—	GET	204	91.189.91.97:80	http://connectivity-check.ubuntu.com/	US	—	—	whitelisted

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
—	—	91.189.91.49:80	connectivity-check.ubuntu.com	Canonical Group Limited	US	unknown
470	avahi-daemon	224.0.0.251:5353	—	—	—	unknown
—	—	185.125.190.17:80	connectivity-check.ubuntu.com	Canonical Group Limited	GB	unknown
—	—	91.189.91.97:80	connectivity-check.ubuntu.com	Canonical Group Limited	US	unknown
—	—	212.102.56.178:443	odrs.gnome.org	Datacamp Limited	DE	unknown
12939	x86_64.o	185.196.9.5:51237	fdh32fsdfhs.shop	Simple Carrier LLC	US	unknown
485	snapd	185.125.188.59:443	api.snapcraft.io	Canonical Group Limited	GB	unknown
485	snapd	185.125.188.54:443	api.snapcraft.io	Canonical Group Limited	GB	unknown

DNS requests

Domain	IP	Reputation
connectivity-check.ubuntu.com	91.189.91.49 91.189.91.48 91.189.91.97 185.125.190.48 91.189.91.96 185.125.190.96 185.125.190.17 185.125.190.98 185.125.190.97 185.125.190.49 185.125.190.18 91.189.91.98 2620:2d:4000:1::22 2620:2d:4000:1::2a 2620:2d:4000:1::98 2620:2d:4000:1::2b 2620:2d:4002:1::196 2001:67c:1562::23 2620:2d:4000:1::23 2620:2d:4000:1::96 2620:2d:4000:1::97 2001:67c:1562::24 2620:2d:4002:1::197 2620:2d:4002:1::198	whitelisted
google.com	142.250.184.238 2a00:1450:4001:831::200e	whitelisted
odrs.gnome.org	212.102.56.178 195.181.170.18 169.150.255.180 169.150.255.183 207.211.211.26 195.181.175.41 37.19.194.81 2a02:6ea0:c700::107 2a02:6ea0:c700::21 2a02:6ea0:c700::11 2a02:6ea0:c700::18 2a02:6ea0:c700::112 2a02:6ea0:c700::101 2a02:6ea0:c700::19	whitelisted
fdh32fsdfhs.shop	185.196.9.5	unknown
api.snapcraft.io	185.125.188.59 185.125.188.55 185.125.188.54 185.125.188.58	whitelisted
195.100.168.192.in-addr.arpa	—	unknown

Threats

PID	Process	Class	Message
12939	x86_64.o	Malware Command and Control Activity Detected	ET MALWARE ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1)

Add for printing

No debug info

General Info

x86_64

9B0DAF70BC6EE71FF95EB36F10D0C337

E500DFB8CA56B084226D9B49F99553000BD0EDA8

E38146B8AF6197F91E45D7745F8DA0B86EB998CF17101FB0504521B26F6B02DC

768:nF98/zcVt4Lx84LpswKYSEWseUV25/oO/sxR01TbYc8kBRiOgPFNJ0tdTJFI:nz8/zcVt4LxhpsRYndd2SElLBRkXq

Software environment set and analysis options

Launch configuration

Software preset

Behavior activities

MALICIOUS

Connects to the CnC server

MIRAI has been detected (SURICATA)

SUSPICIOUS

Reads /proc/mounts (likely used to find writable filesystems)

Intercepts program crashes

Modifies file or directory owner

Contacting a server suspected of hosting an CnC

Executes commands using command-line interpreter

Executes the "rm" command to delete files or directories

Connects to unusual port

INFO

Malware configuration

Static information

TRiD

EXIF

EXE

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings